linux-kernel - Re: kmemleaks on ac3b43283923 ("module: replace module_layout with module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 11 Apr 2023 10:07:53 -0700
From:   Luis Chamberlain <mcgrof@...nel.org>
To:     Catalin Marinas <catalin.marinas@....com>
Cc:     Song Liu <song@...nel.org>, jim.cromie@...il.com,
        linux-modules@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>,
        Jason Baron <jbaron@...mai.com>,
        Greg KH <gregkh@...uxfoundation.org>
Subject: Re: kmemleaks on ac3b43283923 ("module: replace module_layout with
 module_memory")

On Tue, Apr 11, 2023 at 04:10:24PM +0100, Catalin Marinas wrote:
> On Mon, Apr 03, 2023 at 01:43:58PM -0700, Luis Chamberlain wrote:
> > On Fri, Mar 31, 2023 at 05:27:04PM -0700, Song Liu wrote:
> > > On Fri, Mar 31, 2023 at 12:00 AM Luis Chamberlain <mcgrof@...nel.org> wrote:
> > > > On Thu, Mar 30, 2023 at 04:45:43PM -0600, jim.cromie@...il.com wrote:
> > > > > kmemleak is reporting 19 leaks during boot
> > > > >
> > > > > because the hexdumps appeared to have module-names,
> > > > > and Ive been hacking nearby, and see the same names
> > > > > every time I boot my test-vm, I needed a clearer picture
> > > > > Jason corroborated and bisected.
> > > > >
> > > > > the 19 leaks split into 2 groups,
> > > > > 9 with names of builtin modules in the hexdump,
> > > > > all with the same backtrace
> > > > > 9 without module-names (with a shared backtrace)
> > > > > +1 wo name-ish and a separate backtrace
> > > >
> > > > Song, please take a look.
> > > 
> > > I will look into this next week.
> > 
> > I'm thinking this may be it, at least this gets us to what we used to do
> > as per original Catalinas' 4f2294b6dc88d ("kmemleak: Add modules
> > support") and right before Song's patch.
> > 
> > diff --git a/kernel/module/main.c b/kernel/module/main.c
> > index 6b6da80f363f..3b9c71fa6096 100644
> > --- a/kernel/module/main.c
> > +++ b/kernel/module/main.c
> > @@ -2240,7 +2240,10 @@ static int move_module(struct module *mod, struct load_info *info)
> >  		 * which is inside the block. Just mark it as not being a
> >  		 * leak.
> >  		 */
> > -		kmemleak_ignore(ptr);
> > +		if (type == MOD_INIT_TEXT)
> > +			kmemleak_ignore(ptr);
> > +		else
> > +			kmemleak_not_leak(ptr);
> >  		if (!ptr) {
> >  			t = type;
> >  			goto out_enomem;
> > 
> > We used to use the grey area for the TEXT but the original commit
> > doesn't explain too well why we grey out init but not the others. Ie
> > why kmemleak_ignore() on init and kmemleak_not_leak() on the others.
> 
> It's safe to use the 'grey' colour in all cases. For text sections that
> don't need scanning, there's a slight chance of increasing the false
> negatives, 

It turns out that there are *tons* of false positives today, unless
these are real leaks.

> so marking it 'black' ignores the scanning. For the init
> section, if it gets discarded anyway, just going with
> kmemleak_not_leak() is fine. It simplifies the logic above.

  Luis